Please enable JavaScript.

Coggle requires JavaScript to display documents.

2 - Risk Management - Coggle Diagram

- - - - Serve as the foundation for performing a cost/benefit analysis of asset protection when performing dafeguard selection
      - Serve as a means for evaluating the cost-effectiveness of safeguards and countermeasures
      - Provide values for insurance purposes and establishing an overall net worth or net value for the organization
      - Help senior management understand exactly what is at risk within the organization
      - Prevent negligence of due care/due diligence and encouraging compliance with legal requirements, industry regulations, and internal security policies
    - - Quantitative risk analysis (assign real dollar figures to the loss of an asset)
      - Qualitative risk analysis (assign subjective and intangible values to the loss of an asset)
        
        Scenario based
        
        Description of a threat scenario with its impact
        
        Description of safeguard protecting completely or partially
        
        Assignment of threat level (scale 1-10), a loss potential (scale 1-10), and advantages of each safeguard
        
        Delphi Technique
        
        Anonymous feedback-and-response process used to enable a group to reach an anonymous consensus
      - Best approach: hybrid approach
    - - Decision actions
        
        Assignment/transfer
        
        Deterrence
        
        Implementing deterrents to would-be violators of security and policy (e.g. security cameras, warning banners, etc.)
        
        Avoidance
        
        Eliminate the risk cause (e.g. move from Florida to Arizona to avoid hurricanes)
        
        Acceptance
        
        Reject or ignore
        
        Mitigation/reduction
      - Decision factors
        
        Risk appetite
        
        Total amount of risk that an organization is willing to shoulder in aggregate across all assets
        
        Risk capacity
        
        Level of risk an organization is able to shoulder
        
        Risk tolerance
        
        Amount or level of risk that an organization will accept per individual asset-threat pair (aka risk target)
        
        Risk limit
        
        Maximum level of risk above the risk target that will be tolerated before further risk management actions are taken
        
        Inherent risk
        = initial risk
        
        Level of natural, native, or default risk in an environment, system, or product before any risk management efforts are performed
        
        Residual risk
        = total risk - controls gap
        
        Threats for which upper management decide to not implement safeguards
        
        Total risk = threats x vulnerabilities x assets
      - Categories of security controls
        
        Physical Controls (e.g. policies, procedures)
        
        Logical/Technical Controls
        
        Administrative Controls
      - Types of Controls
        
        Preventive (e.g. fences, locks, DLP, job rotation)
        
        Detection (e.g. CCTV, honeypots)
        
        Corrective (e.g. backup and restore plan, IPS)
        
        Recovery (e.g. backups and restores, fault-tolerant drive systems)
        
        Deterrent (e.g. security awareness training, guards, access control vestibules)
        
        Directive (e.g. security policy requirements, escape route exit signs)
        
        Compensating (e.g. disaster recovery plan)